File name:

2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/afe69046-8644-4d57-97a5-cc0c4c39d4a1
Verdict: Malicious activity
Analysis date: April 29, 2025, 10:50:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
aspack
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

428D1300FDB70A3F1ED05DD3528E90C7

SHA1:

A242460B193172366E6336FD4BB294CE90FAF38C

SHA256:

FFADB4CA6AB7C8E3623210B4DBD41D0921894E97860F31480084096627D14314

SSDEEP:

98304:h4bF8ttgGY/srGGGGGGSnNfYU7zhiKC5U8kk/kdHPflEtLMH46qmHBHiBb+n5/Gx:Fw34

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • mscaps.exe (PID: 6300)
      • launch.exe (PID: 5064)

    • Loads dropped or rewritten executable

      • FileCoAuth.exe (PID: 208)
      • WdExt.exe (PID: 4620)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1764)
      • @AEC99B.tmp.exe (PID: 5428)
      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • WdExt.exe (PID: 4620)
      • wtmps.exe (PID: 2504)
      • mscaps.exe (PID: 6300)

    • Creates file in the systems drive root

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)

    • Process drops legitimate windows executable

      • @AEC99B.tmp.exe (PID: 5428)
      • WdExt.exe (PID: 4620)

    • Reads security settings of Internet Explorer

      • @AEC99B.tmp.exe (PID: 5428)
      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • WdExt.exe (PID: 4620)
      • launch.exe (PID: 5064)

    • Executing commands from a ".bat" file

      • @AEC99B.tmp.exe (PID: 5428)
      • WdExt.exe (PID: 4620)
      • launch.exe (PID: 5064)

    • The executable file from the user directory is run by the CMD process

      • WdExt.exe (PID: 4620)
      • wtmps.exe (PID: 2504)
      • launch.exe (PID: 5064)

    • Starts CMD.EXE for commands execution

      • WdExt.exe (PID: 4620)
      • @AEC99B.tmp.exe (PID: 5428)
      • launch.exe (PID: 5064)

    • There is functionality for taking screenshot (YARA)

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)

  • INFO

    • The sample compiled with english language support

      • explorer.exe (PID: 1764)
      • @AEC99B.tmp.exe (PID: 5428)
      • WdExt.exe (PID: 4620)

    • Create files in a temporary directory

      • explorer.exe (PID: 1764)
      • WdExt.exe (PID: 4620)
      • mscaps.exe (PID: 6300)
      • @AEC99B.tmp.exe (PID: 5428)

    • Checks supported languages

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 1676)
      • @AEC99B.tmp.exe (PID: 5428)
      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • WdExt.exe (PID: 4620)
      • launch.exe (PID: 5064)
      • wtmps.exe (PID: 2504)
      • mscaps.exe (PID: 6300)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1764)

    • Creates files or folders in the user directory

      • @AEC99B.tmp.exe (PID: 5428)
      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • WdExt.exe (PID: 4620)
      • launch.exe (PID: 5064)
      • wtmps.exe (PID: 2504)
      • mscaps.exe (PID: 6300)

    • Reads the computer name

      • @AEC99B.tmp.exe (PID: 5428)
      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)
      • WdExt.exe (PID: 4620)
      • launch.exe (PID: 5064)

    • Process checks computer location settings

      • WdExt.exe (PID: 4620)
      • @AEC99B.tmp.exe (PID: 5428)
      • launch.exe (PID: 5064)

    • Aspack has been detected

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)

    • UPX packer has been detected

      • 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe (PID: 7012)

    • Checks proxy server information

      • @AEC99B.tmp.exe (PID: 5428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:03:05 08:37:55+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 2560
InitializedDataSize: 29696
UninitializedDataSize: -
EntryPoint: 0x167f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
20
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe no specs explorer.exe @aec99b.tmp.exe 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wdext.exe cmd.exe no specs conhost.exe no specs launch.exe cmd.exe no specs conhost.exe no specs wtmps.exe rundll32.exe no specs mscaps.exe sppextcomobj.exe no specs slui.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Temp\admin1.bat" "C:\Windows\SysWOW64\cmd.exe—WdExt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1512C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Temp\admin1.bat" "C:\Windows\SysWOW64\cmd.exe—@AEC99B.tmp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1676"C:\Users\admin\Desktop\2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1764explorer.exeC:\Windows\SysWOW64\explorer.exe
2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
1764C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Temp\admin0.bat" "C:\Windows\SysWOW64\cmd.exe—@AEC99B.tmp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2108"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2504"C:\Users\admin\AppData\Local\Temp\wtmps.exe" C:\Users\admin\AppData\Local\Temp\wtmps.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\wtmps.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 974
Read events
3 962
Write events
12
Delete events
0

Modification events

(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Start
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Start
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
04000000030000000E00000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
010000000000000004000000050000000200000003000000FFFFFFFF
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAAC000000
(PID) Process:(7012) 2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D1A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAAC000000
(PID) Process:(5064) launch.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows Defender Extension
Value:
"C:\Users\admin\AppData\Roaming\Microsoft\Defender\launch.exe"
(PID) Process:(6300) mscaps.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:JREUpdate
Value:
"C:\Users\admin\AppData\Roaming\Microsoft\Protect\SETUP\mscaps.exe" /s /n /i:U shell32.dll
Executable files
17
Suspicious files
13
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5428@AEC99B.tmp.exeC:\Users\admin\AppData\Local\Temp\tmpD44C.tmpbinary
MD5:49C8F0DDD16D3DDF74D55709FF4E0D14
SHA256:807D79214258A40731408CB343820A421E60DC105A4DAF766F3C4E85289219C3
70122025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Start\update.exeexecutable
MD5:8A6BDD6A84FE3487BD2D0F45261A6E9C
SHA256:5FEBDE0FF16F83E755CDBD4C7433CE7995AD9C2DE7B6199337E4921874DC9D2F
1764explorer.exeC:\Users\admin\AppData\Local\Temp\@AEC99B.tmp.exeexecutable
MD5:7A2BE69C2A8ACEC7218D925B22693D84
SHA256:5F50BAADAEF9420AF9D106CC59FF7F52DD82F587BB8F3B9CC2D700C790433217
4620WdExt.exeC:\Users\admin\AppData\Roaming\Temp\mydll.dllexecutable
MD5:FC4A6145DDD1B64983E8700601C71FC6
SHA256:5D920A7A5486E7C1693334D59271F2A59A64B59A8FA87FA4BA71AACCE4CDF8A6
5428@AEC99B.tmp.exeC:\Users\admin\AppData\Local\Temp\tmpD2B3.tmpexecutable
MD5:E835E34E4C520203476B2CCD8DA9F362
SHA256:75A3017F3FA6065824B9E59DCD0B9D99C86E29739BC2DDA3ACC5524EA7192530
5428@AEC99B.tmp.exeC:\Users\admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exeexecutable
MD5:7A2BE69C2A8ACEC7218D925B22693D84
SHA256:5F50BAADAEF9420AF9D106CC59FF7F52DD82F587BB8F3B9CC2D700C790433217
5428@AEC99B.tmp.exeC:\Users\admin\AppData\Roaming\Temp\mydll.dllexecutable
MD5:FC4A6145DDD1B64983E8700601C71FC6
SHA256:5D920A7A5486E7C1693334D59271F2A59A64B59A8FA87FA4BA71AACCE4CDF8A6
5428@AEC99B.tmp.exeC:\Users\admin\AppData\Roaming\Temp\admin0.battext
MD5:F2D4F8A8491F3A5151B05D92F283EBEF
SHA256:CCC42E2A79C7DFE395EB6BD21CAD4D44D526C5A361953175573DB7B59BE57EBC
4620WdExt.exeC:\Users\admin\AppData\Local\Temp\tmpD68C.tmpexecutable
MD5:2D9DF706D1857434FCAA014DF70D1C66
SHA256:126593B3672E6985FE4E4903D656040E16A69264FAF91B1A416EF00565E17E7C
4620WdExt.exeC:\Users\admin\AppData\Roaming\Microsoft\Identities\admin\arc.dllbinary
MD5:8501E1FAEFA7B184FD627F822F53697C
SHA256:70E0437A0E6E9E00F1100EA438F95BA871EC51C55FBF2355B693F368596F605F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6712
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
windowsupdate.microsoft.com
  • 20.109.209.108
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.130
  • 40.126.31.131
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-11_428d1300fdb70a3f1ed05dd3528e90c7_amadey_darpapox_elex_nymaim_rhadamanthys_smoke-loader